vidar | 4379e1290aa5d36cc98722935afab5764ba64d61e9f0615b5395c2a22c75d80a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 214KB
Sample240407-1fbcmsfb2y
SHA256 4379e1290aa5d36cc98722935afab5764ba64d61e9f0615b5395c2a22c75d80a
MD5 44ec00c94ceb935df7244cb692fec9b8
SHA1 aad96da95feeadd4cbe7f504a055fa1896c7414c
SHA512 0adc31bc898bcf2ff3057b9cfb67a65bfc127c3849ad64133c273a45bde4901b4667790e5a59b959a711f0ddf5aa71a89ebc6285f41e0f5b921d59f07be52497
SSDEEP 6144:pnkd9Rk0WB3H38DwMXHQg/Z9ScXJ+xovgnkBBG:uHiLcDwMXw8ZscXJ+xoonkBB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar stealer

Malware Config

Extracted

Family

vidar

https://steamcommunity.com/profiles/76561199662282318
https://t.me/t8jmhl

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/220-4-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/220-7-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7
behavioral2/memory/220-12-0x0000000000400000-0x0000000000648000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 220	948	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	220	WerFault.exe	87

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87
PID 948 wrote to memory of 220	948	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 2228
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220
1⤵
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-4-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/220-7-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/220-12-0x0000000000400000-0x0000000000648000-memory.dmp

Download

memory/948-0-0x0000000000CC0000-0x0000000000CFC000-memory.dmp

Download

memory/948-1-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/948-10-0x0000000074810000-0x0000000074FC0000-memory.dmp

Download

memory/948-11-0x0000000002F90000-0x0000000004F90000-memory.dmp

Download

memory/948-16-0x0000000002F90000-0x0000000004F90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads